What is IP Reputation; where does TR7 use IP Reputation data?

Short answer

IP Reputation is a classification based on whether an IP address has been involved in malicious activity (DDoS, port scan, brute-force, spam, web application attack, etc.) in the past. In TR7 this data is managed on the IP Intelligence & Reputation screen: TR7's categorized threat database, the defined External Sources (at most 10 URLs) and the manually added Blacklist Content entries form a merged blacklist; the records are labeled with 25 categories (User Blacklist, External and 23 threat categories), and the addresses in Whitelist Content always take priority. The same data is used by IP Reputation Protection and the Bot Protection factors in Bot/DDoS, the Blacklist Protection setting of the WAF, the Blacklist IP Category condition in Load Balancer and the Blacklist rule of L4 DDoS Protection.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → Settings → General Settings → IP Intelligence & Reputation	IP Categories, Blacklist Content, Whitelist Content, External Sources	Viewing and updating the reputation data, and adding/exempting manually
IP Intelligence & Reputation → IP lookup	IP Lookup	Querying whether an address is on the list, and its categories
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management	IP Reputation Protection card	Quarantine, Block or another action by category; starts in Active mode when protection is turned on
Bot/DDoS Management → Bot Protection → Factors	Infrastructure & IP Reputation	The contribution of the address's categories to the bot score
Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Whitelist & Blacklist	Blacklist Protection, Blacklist IP Category	Giving a 100-point violation to a request coming from an address on the list
Configuration Menu → Load Balancer → Conditions (Policy Match)	Blacklist IP Category	Applying rule-based actions to addresses in specific categories
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management	Blacklist box	Monitoring or dropping the packets of addresses on the list at the network layer; default Monitor

• Ways of blocking by category: Can I block known malicious IPs (IP Reputation / blacklist category)?
• The relation between WAF and Bot/DDoS: Is the WAF's IP reputation information shared with IP Reputation protection in L7 DDoS & Threat Protection?
• The difference from network type: What is Network Type; how does it differ from IP Reputation?

Common Misconceptions

• "An address that is not on the blacklist is safe." IP Reputation reflects only the known history; new sources that are not on the list are caught by other protections such as L7 DDoS Protection, Bot Protection and WAF.
• "An address on the blacklist is blocked in every case." An address in Whitelist Content always takes priority. In addition, each layer gives the result with its own setting: by default, the Blacklist rule of L4 DDoS Protection only monitors (Monitor), and in Monitor mode the WAF only records.
• "IP Reputation and network type are the same thing." IP Reputation describes the malicious activity history of the address, while network type describes the type of network the address belongs to (such as datacenter, CDN, anonymizer).

How it is done in the documentation

• IP Intelligence & Reputation · Where and How Is It Used?
• IP Intelligence & Reputation · IP Categories
• IP Reputation Protection · The Default Rules
• Whitelist & Blacklist · Blacklist Protection
• Blacklist · What Is Blacklist?

Related questions

• Can I block known malicious IPs (IP Reputation / blacklist category)?
• Can I automatically block requests from IPs with a bad reputation (Blacklist Protection)?
• What is the difference between the vService blacklist and the IP intelligence list?
• Is the WAF's IP reputation information shared with IP Reputation protection in L7 DDoS & Threat Protection?